spa.myddns.me Open in urlscan Pro
172.105.154.252 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://spa.myddns.me/BOA/cd.html
Submission: On July 17 via automatic, source openphish (July 17th 2024, 1:05:24 pm UTC) — Scanned from CA

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 12 HTTP transactions. The main IP is 172.105.154.252, located in Atlanta, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is spa.myddns.me.
TLS certificate: Issued by R10 on July 17th 2024. Valid for: 3 months.

This is the only time spa.myddns.me was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Bank of America (Banking)

Domain & IP information

	IP Address		AS Autonomous System
12	172.105.154.252 172.105.154.252		63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
12	1

12 172.105.154.252 (Atlanta, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: 172-105-154-252.ip.linodeusercontent.com

spa.myddns.me	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	myddns.me spa.myddns.me	598 KB
12	1

	Domain	Requested by
12	spa.myddns.me	spa.myddns.me
12	1

This site contains no links.

Subject Issuer	Validity	Valid
spa.myddns.me R10	`2024-07-17` - `2024-10-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://spa.myddns.me/BOA/cd.html
Frame ID: 09C2174E29B62D91991B264966359CE5
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bank of America | Online Banking | Login

Page Statistics

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

598 kB
Transfer

595 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request cd.html Show response spa.myddns.me/BOA/	352 KB 353 KB	480ms 124ms	Document text/html	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `7e25c25d35a3863022d78d60a4c8b362e1b0cf6d4b1e6f7a971ff02547768acb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Accept-Ranges bytes Connection Keep-Alive Content-Length 360724 Content-Type text/html Date Wed, 17 Jul 2024 13:05:19 GMT Keep-Alive timeout=5, max=100 Last-Modified Tue, 18 Oct 2022 23:40:56 GMT Server Apache
GET H/1.1	200 OK	mask.js Show response spa.myddns.me/BOA/images/	146 KB 146 KB	263ms 98ms	Script text/javascript	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://spa.myddns.me/BOA/images/mask.js Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Thu, 03 Mar 2022 00:50:54 GMT Server Apache Content-Type text/javascript Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=99 Content-Length 149061
GET H/1.1	200 OK	assets-images-global-logos-BofA_rgb-CSX5624a146.svg spa.myddns.me/BOA/images/	3 KB 4 KB	219ms 97ms	Image image/svg+xml	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-global-logos-BofA_rgb-CSX5624a146.svg Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `6c7f8fb9f19d36be96cb37942cbd0ff926437d0ad258fbbbd7e24a85b2b85f6b` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 19:21:16 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 3527
GET H/1.1	200 OK	assets-images-site-secure-ah-forgot-common-BofA_symbol_rgb-CSX33067442.svg spa.myddns.me/BOA/images/	2 KB 2 KB	318ms 98ms	Image image/svg+xml	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-site-secure-ah-forgot-common-BofA_symbol_rgb-CSX33067442.svg Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `46b1bdd52215324f3660248b3d50538503d8ad4f32afe3d82e2d8f7b35bf820d` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 19:21:32 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 2007
GET H/1.1	404 Not Found	assets-images-site-secure-ah-forgot-common-loader_black-CSX85ecad56.gif spa.myddns.me/BOA/images/	315 B 315 B	268ms 103ms	Image text/html	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-site-secure-ah-forgot-common-loader_black-CSX85ecad56.gif Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	assets-images-global-header-lock-CSX1f35fd71.png spa.myddns.me/BOA/images/	51 KB 51 KB	282ms 105ms	Image image/png	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-global-header-lock-CSX1f35fd71.png Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `38fc756dfdd0689c674e787e6e030549f7f3856e533350aabeb46cce0d2b9b77` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 19:10:14 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 52278
GET H/1.1	200 OK	assets-images-global-footer-eha_logo_1x-CSXc5bd9130.png spa.myddns.me/BOA/images/	343 B 584 B	277ms 97ms	Image image/png	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-global-footer-eha_logo_1x-CSXc5bd9130.png Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `35a77234f396ce2e5cc205ab9dd78c0cef11eaf14e4ef92bb910243021e83147` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 19:21:52 GMT Server Apache Content-Type image/png Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=96 Content-Length 343
GET H/1.1	200 OK	assets-images-global-header-secure-lock-CSXa09bf5fc.svg spa.myddns.me/BOA/images/	353 B 599 B	383ms 189ms	Image image/svg+xml	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-global-header-secure-lock-CSXa09bf5fc.svg Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `ef1e2c7f7966523d78b1c294052dfa4b2db256a21ead9fb711d187e0fd54be7a` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 19:21:56 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 353
GET H/1.1	200 OK	assets-images-global-title-flagscape_red-CSX345e7fd7.svg spa.myddns.me/BOA/images/	2 KB 2 KB	151ms 143ms	Image image/svg+xml	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Show image Full URL https://spa.myddns.me/BOA/images/assets-images-global-title-flagscape_red-CSX345e7fd7.svg Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `a154e9972c58b8a28ab486b93d7b7a702bf3f71505b5c1556b8fdaa8ab12b95a` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 19:21:06 GMT Server Apache Content-Type image/svg+xml Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2124
GET H/1.1	200 OK	cnx-regular.woff2 spa.myddns.me/BOA/	11 KB 12 KB	98ms 97ms	Font font/woff2	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://spa.myddns.me/BOA/cnx-regular.woff2 Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `79f02d139cfd07f2a19e0a8831553b3de4627fcab371e18eb776af035465949b` Request headers Referer https://spa.myddns.me/BOA/cd.html Origin https://spa.myddns.me User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 18:30:38 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=95 Content-Length 11608
GET H/1.1	200 OK	cnx-medium.woff2 spa.myddns.me/BOA/	12 KB 12 KB	106ms 105ms	Font font/woff2	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://spa.myddns.me/BOA/cnx-medium.woff2 Requested by Host: spa.myddns.me URL: https://spa.myddns.me/BOA/cd.html Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `a431986817e5d309cdd61c623a5259d6ea5840375876ffb41f5a2cab65ddd2e3` Request headers Referer https://spa.myddns.me/BOA/cd.html Origin https://spa.myddns.me User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 18:30:30 GMT Server Apache Content-Type font/woff2 Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 11984
GET H/1.1	200 OK	favicon.ico spa.myddns.me/BOA/images/	15 KB 15 KB	109ms 109ms	Other image/x-icon	172.105.154.252 AKAMAI-LINODE-AP ...
General Check archive.org Show headers Download Go to Full URL https://spa.myddns.me/BOA/images/favicon.ico Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 172.105.154.252 Atlanta, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG), Reverse DNS 172-105-154-252.ip.linodeusercontent.com Software Apache / Resource Hash `d5bba1cae66759adfee0d50ab0419e6bb19a48f8c360e4be8e582ba75e7a1402` Request headers Referer https://spa.myddns.me/BOA/cd.html User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 Response headers Date Wed, 17 Jul 2024 13:05:19 GMT Last-Modified Tue, 18 Oct 2022 20:20:26 GMT Server Apache Content-Type image/x-icon Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=97 Content-Length 15086

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Bank of America (Banking)

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

function| IMask object| element object| maskOptions object| mask

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
intervention	info	URL: https://spa.myddns.me/BOA/cd.html(Line 103) Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://spa.myddns.me/BOA/cnx-regular.woff2
intervention	info	URL: https://spa.myddns.me/BOA/cd.html Message: Slow network is detected. See https://www.chromestatus.com/feature/5636954674692096 for more details. Fallback font will be used while loading: https://spa.myddns.me/BOA/cnx-medium.woff2
network	error	URL: https://spa.myddns.me/BOA/images/assets-images-site-secure-ah-forgot-common-loader_black-CSX85ecad56.gif Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

spa.myddns.me
172.105.154.252
35a77234f396ce2e5cc205ab9dd78c0cef11eaf14e4ef92bb910243021e83147
38fc756dfdd0689c674e787e6e030549f7f3856e533350aabeb46cce0d2b9b77
3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237
46b1bdd52215324f3660248b3d50538503d8ad4f32afe3d82e2d8f7b35bf820d
6c7f8fb9f19d36be96cb37942cbd0ff926437d0ad258fbbbd7e24a85b2b85f6b
79f02d139cfd07f2a19e0a8831553b3de4627fcab371e18eb776af035465949b
7e25c25d35a3863022d78d60a4c8b362e1b0cf6d4b1e6f7a971ff02547768acb
a154e9972c58b8a28ab486b93d7b7a702bf3f71505b5c1556b8fdaa8ab12b95a
a431986817e5d309cdd61c623a5259d6ea5840375876ffb41f5a2cab65ddd2e3
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d5bba1cae66759adfee0d50ab0419e6bb19a48f8c360e4be8e582ba75e7a1402
ef1e2c7f7966523d78b1c294052dfa4b2db256a21ead9fb711d187e0fd54be7a

spa.myddns.me Open in urlscan Pro 172.105.154.252 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page Statistics

12 Requests

100 %HTTPS

0 %IPv6

1 Domains

1 Subdomains

1 IPs

1 Countries

598 kBTransfer

595 kBSize

0 Cookies

0 Outgoing links

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

4 JavaScript Global Variables

0 Cookies

3 Console Messages

Indicators

spa.myddns.me Open in urlscan Pro
172.105.154.252 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

598 kB
Transfer

595 kB
Size

0
Cookies

12 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!